topic Cisco ACS 5.3 - external proxy service user logs in Network Access Control

Cisco ACS 5.3 - external proxy service user logs

andrewswanson — Mon, 11 Mar 2019 02:00:20 GMT

Hello

We are currently using Cisco ACS 5.3.0.40.2. One of the Services Selection Policy it hosts is:

Receive Authentication request from a wireless controller for a wireless user
If the wireless user's username contains a particular domain suffix, the request is proxied to an external proxy server using an External Proxy service (configured for both local/remote accounting)
On receiving an Acccess-Accept from the external proxy, the user is given access and ACS 5 will start logging account packets for the username (nothing appears in the RADIUS authentication logs - ACS 5 it seems doesn't log proxied authentication requests)

The above setup works fine in most instances. We start to have problems when an external proxy server strips the domain suffix off the username in the Access-Accept packet e.g.

ACS 5 proxies an Access-Request to an external proxy server (with Username = someuser@somwhere.com)
The external proxy replies with an Access-Accept (with Username = someuser)
The user 'someuser' is given access but subsequent accounting attempts fail because their username (without the domain suffix) doesn't match the Service Selection Policy

Is there any way to get ACS 5.3 to log proxied authentication requests? If not, can I configure ACS 5.3 to use the username in the Access-Request packet (rather than the username in the Access-Accept packet) for accounting?

Thanks
Andy

ps i don't have any control over the external proxy servers

Cisco ACS 5.3 - external proxy service user logs

andrewswanson — Mon, 09 Jul 2012 10:53:48 GMT

ACS 5.4 will log proxied authentication requests. So in the above scenario with ACS 5.4, the proxied user someuser@somewhere.com will appear in the RADIUS authentication logs - it will still appear in the accounting logs as 'someuser' but you can you can easily match the accounting and authentication records.

Currently with ACS 5.3, i use a FreeRADIUS box to rewrite the usernames of proxied requests in case they are modified in the reply:

update proxy-reply {

User-Name := "%{proxy-request:User-Name}"

I'll be able to do this with ACS if I could manipulate Inbound RADIUS attributes - ACS 5.4 can manipulate Outbound RADIUS attributes only - Inbound manipulation will hopefully be introduced in a later version.

cheers

andy

Cisco ACS 5.3 - external proxy service user logs

Amjad Abdullah — Wed, 17 Apr 2013 05:32:28 GMT

Thanks Andy for coming back to comment on your own issue after about one year from the original post.